CloudAgent gives you AI agents that manage your cloud infrastructure. They handle tasks like security compliance, cost optimization, deployments, and monitoring. You remain in control as agents show you their plans, wait for your approval, then execute. Think of it as having a cloud operations team that works 24/7 without needing to hire an army of cloud experts.

How can AI agents be trusted with production cloud infrastructure?

You stay in control through approval workflows where every infrastructure change can require human approval before execution, custom security controls with granular access rules, complete audit trails of every action, self-hosted deployment options, and progressive trust models starting with read-only access.

How does it actually reduce costs?

CloudAgent agents delete unused resources, schedule non-production shutdowns, right-size infrastructure based on usage patterns, and recommend architectural optimizations. Early customers report 15-40% cost reduction within 90 days. Unlike dashboards, CloudAgent actually fixes the problems.

1. Assessment Phase

AWS GxP 21 CFR Part 11 Compliance Assessment Execution

20 Credits

AWS GxP 21 CFR Part 11 Compliance Report

Overview

This report evaluates AWS configurations against the automated controls mapped to AWS GxP 21 CFR Part 11. The assessment covers 12 mapped controls using 130 enabled configuration checks. Framework requirements without automated mappings remain available for manual review. Technical findings support compliance evidence collection and remediation; they do not certify compliance.

Mapped controls

11.10 Controls for closed systems: AWS account is part of AWS Organizations, RDS and Aurora Covered by AWS Backup, DynamoDB Tables Covered by AWS Backup, EBS Volumes Covered by AWS Backup, EC2 instances Covered by AWS Backup, EFS Covered by AWS Backup, FSx File Systems Covered by AWS Backup, Backup Plans Minimum Retention Configured (35 days), Backup Recovery Points are Encrypted, Backup Vault Recovery Point Manual Deletion is Disabled, Backup Recovery Points Do Not Expire Before Retention Period, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, Ensure CloudTrail is Enabled for this Region, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, CloudWatch Log Groups Retention Policy Configured, Database Migration Service Instance Not Public, DynamoDB Encryption with KMS Enabled, DynamoDB Table Point-in-time Recovery Enabled, DynamoDB Auto Scaling is Enabled, EBS Snapshots Should Not Be Publicly Restorable, EBS Volume In Use, No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to RDP (TCP 3389), EC2 Instance Metadata Service v2 Enforced, EC2 Default Encryption is Enabled, EC2 Instance EBS Optimization Enabled, EC2 Instance Volumes are Encrypted, IAM Instance Profile is Attached to EC2 Instance, EC2 Instances in a VPC (No Classic EC2), EC2 Launch Templates Do Not Assign Public IPs, EC2 Instances Managed by Systems Manager (SSM), EC2 Instances Compliant with SSM Patching Requirements, No EC2 Instances Stopped for More Than 30 Days, ECR Lifecycle Policies Enabled, ECS Task Definition User Check for Host Mode, EFS Encryption At-Rest Enabled, ElastiCache (Redis) Automatic Backups are Enabled, ElastiCache (Redis) Snapshot Retention Period 7 days or More, Load Balancers Configured for Cross Zone Load Balancing, Load Balancer Access Logging is Enabled., Load Balancers Deletion Protection Enabled, EMR Kerberos Authentication Configured, EMR Cluster Instances do not Allow Public Access, Elasticsearch Audit Logging is Enabled, Elasticsearch Node-to-Node Encryption is Enabled, Elasticsearch Storage Encryption is Enabled, Amazon Elasticsearch Domain is in a VPC, Amazon Elasticsearch Domain Application/Performance Logging Enabled, No Access Keys for Root Account, MFA for Root Account is Enabled, Hardware MFA for Root Account is Enabled, MFA for Users with Console Access, No IAM Principals with access to blocked actions on KMS, No Empty IAM Groups, No Inline IAM Policies Attached, IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater), No IAM Principals with Full Administrator Permissions ":", IAM Access Keys Are Rotated every 90 Days, IAM Users in Groups, IAM Policies Attached to Roles or Groups Only, No Unused IAM User Credentials (90 Days), Lambda functions should be in a VPC., No Public Accessible Lambda Functions, RDS Cluster/Instance Security Group Does Not Allow 0.0.0.0/0 and ::/0, RDS Storage Encryption is Enabled, RDS Automatic Backups Enabled, RDS Deletion Protection Enabled, RDS Logging Enabled, RDS Multi Availability Zones Configured, RDS Snapshots are Encrypted At-Rest, No Public Redshift Clusters, Redshift Clusters Encrypted At-Rest, Redshift Automatic Snapshots Enabled, Redshift Clusters Use Enhanced VPC Routing, Redshift Clusters Audit Logging Enabled, Redshift Cluster Encryption In-Transit is Enabled, No Public S3 Buckets, S3 Bucket Encryption is Enabled, S3 Bucket Versioning Enabled, S3 Block Public Access is Enabled (Account-Level), S3 Bucket Lifecycle Rules are Configured, S3 Bucket Access Logging Enabled, S3 Bucket Object Lock is Enabled, S3 Bucket Encryption in Transit is Enforced, SageMaker Endpoint Configuration Encrypted At-Rest, SageMaker Notebook Instance Encryption At-Rest Enabled, No Direct Internet Access for SageMaker Notebook Instance, Secrets Manager Secrets Automatic Rotation is Enabled, Secrets Manager Secrets Are Rotated Per Schedule, Default Security Group No Rules, No Public SSM documents (customer owned), EC2 Instance Compliant SSM Association Status, API Gateway Stage Access Logging Enabled, API Gateway Stage Logging is Enabled, VPC Flow Logs Enabled, VPC Route Tables Restrict Public Access to IGW, Vpc security group restrict ingress common ports all, VPC Security Groups Should Restrict Ingress TCP And UDP Access From 0.0.0.0/0, Backup VPN Connection Configured, WAF WebACL Logging Enabled
11.10(a) Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records: RDS and Aurora Covered by AWS Backup, DynamoDB Tables Covered by AWS Backup, EBS Volumes Covered by AWS Backup, EC2 instances Covered by AWS Backup, EFS Covered by AWS Backup, FSx File Systems Covered by AWS Backup, Backup Plans Minimum Retention Configured (35 days), Backup Recovery Points are Encrypted, Backup Vault Recovery Point Manual Deletion is Disabled, Backup Recovery Points Do Not Expire Before Retention Period, Ensure that CloudTrail Log File Validation is Enabled, Ensure CloudTrail is Enabled for this Region, DynamoDB Table Point-in-time Recovery Enabled, DynamoDB Auto Scaling is Enabled, EBS Volume In Use, EC2 Instance EBS Optimization Enabled, EC2 Instances Managed by Systems Manager (SSM), EC2 Instances Compliant with SSM Patching Requirements, No EC2 Instances Stopped for More Than 30 Days, ElastiCache (Redis) Automatic Backups are Enabled, ElastiCache (Redis) Snapshot Retention Period 7 days or More, Load Balancers Configured for Cross Zone Load Balancing, Load Balancers Deletion Protection Enabled, RDS Automatic Backups Enabled, RDS Deletion Protection Enabled, RDS Multi Availability Zones Configured, Redshift Automatic Snapshots Enabled, S3 Bucket Encryption is Enabled, S3 Bucket Versioning Enabled, S3 Bucket Object Lock is Enabled, EC2 Instance Compliant SSM Association Status, Backup VPN Connection Configured
11.10(c) Protection of records to enable their accurate and ready retrieval throughout the records retention period: RDS and Aurora Covered by AWS Backup, DynamoDB Tables Covered by AWS Backup, EBS Volumes Covered by AWS Backup, EFS Covered by AWS Backup, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, Ensure CloudTrail is Enabled for this Region, CloudWatch Log Groups Retention Policy Configured, DynamoDB Table Point-in-time Recovery Enabled, EC2 Instance EBS Optimization Enabled, ECR Lifecycle Policies Enabled, ElastiCache (Redis) Automatic Backups are Enabled, ElastiCache (Redis) Snapshot Retention Period 7 days or More, RDS Storage Encryption is Enabled, RDS Automatic Backups Enabled, RDS Snapshots are Encrypted At-Rest, No Public Redshift Clusters, Redshift Automatic Snapshots Enabled, Redshift Clusters Audit Logging Enabled, Redshift Cluster Encryption In-Transit is Enabled, No Public S3 Buckets, S3 Bucket Encryption is Enabled, S3 Bucket Versioning Enabled, S3 Bucket Lifecycle Rules are Configured, S3 Bucket Encryption in Transit is Enforced, SageMaker Endpoint Configuration Encrypted At-Rest, SageMaker Notebook Instance Encryption At-Rest Enabled, No Direct Internet Access for SageMaker Notebook Instance
11.10(d) Limiting system access to authorized individuals: AWS account is part of AWS Organizations, Database Migration Service Instance Not Public, DynamoDB Encryption with KMS Enabled, EBS Snapshots Should Not Be Publicly Restorable, EBS Volume In Use, No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to RDP (TCP 3389), EC2 Instance Metadata Service v2 Enforced, EC2 Default Encryption is Enabled, EC2 Instance Volumes are Encrypted, IAM Instance Profile is Attached to EC2 Instance, EC2 Instances in a VPC (No Classic EC2), EC2 Launch Templates Do Not Assign Public IPs, ECS Task Definition User Check for Host Mode, EFS Encryption At-Rest Enabled, EMR Kerberos Authentication Configured, EMR Cluster Instances do not Allow Public Access, Elasticsearch Node-to-Node Encryption is Enabled, Elasticsearch Storage Encryption is Enabled, Amazon Elasticsearch Domain is in a VPC, No Access Keys for Root Account, MFA for Root Account is Enabled, Hardware MFA for Root Account is Enabled, MFA for Users with Console Access, No IAM Principals with access to blocked actions on KMS, No Empty IAM Groups, No Inline IAM Policies Attached, IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater), No IAM Principals with Full Administrator Permissions ":", IAM Access Keys Are Rotated every 90 Days, IAM Users in Groups, IAM Policies Attached to Roles or Groups Only, No Unused IAM User Credentials (90 Days), Lambda functions should be in a VPC., No Public Accessible Lambda Functions, RDS Cluster/Instance Security Group Does Not Allow 0.0.0.0/0 and ::/0, RDS Storage Encryption is Enabled, No Public Redshift Clusters, No Public S3 Buckets, S3 Block Public Access is Enabled (Account-Level), No Direct Internet Access for SageMaker Notebook Instance, Secrets Manager Secrets Automatic Rotation is Enabled, Secrets Manager Secrets Are Rotated Per Schedule, Default Security Group No Rules, No Public SSM documents (customer owned), VPC Route Tables Restrict Public Access to IGW, Vpc security group restrict ingress common ports all, VPC Security Groups Should Restrict Ingress TCP And UDP Access From 0.0.0.0/0
11.10(e) Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records: RDS and Aurora Covered by AWS Backup, DynamoDB Tables Covered by AWS Backup, EBS Volumes Covered by AWS Backup, EFS Covered by AWS Backup, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure CloudTrail is Enabled for this Region, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, CloudWatch Log Groups Retention Policy Configured, DynamoDB Table Point-in-time Recovery Enabled, EC2 Instance EBS Optimization Enabled, ElastiCache (Redis) Automatic Backups are Enabled, ElastiCache (Redis) Snapshot Retention Period 7 days or More, Load Balancer Access Logging is Enabled., Elasticsearch Audit Logging is Enabled, Amazon Elasticsearch Domain Application/Performance Logging Enabled, RDS Automatic Backups Enabled, RDS Logging Enabled, Redshift Automatic Snapshots Enabled, Redshift Clusters Audit Logging Enabled, S3 Bucket Encryption is Enabled, S3 Bucket Versioning Enabled, S3 Bucket Access Logging Enabled, API Gateway Stage Access Logging Enabled, API Gateway Stage Logging is Enabled, VPC Flow Logs Enabled, WAF WebACL Logging Enabled
11.10(g) Use of authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand: AWS account is part of AWS Organizations, Database Migration Service Instance Not Public, DynamoDB Encryption with KMS Enabled, EBS Snapshots Should Not Be Publicly Restorable, EBS Volume In Use, No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to RDP (TCP 3389), EC2 Instance Metadata Service v2 Enforced, EC2 Default Encryption is Enabled, EC2 Instance Volumes are Encrypted, IAM Instance Profile is Attached to EC2 Instance, EC2 Instances in a VPC (No Classic EC2), EC2 Launch Templates Do Not Assign Public IPs, ECS Task Definition User Check for Host Mode, EFS Encryption At-Rest Enabled, EMR Kerberos Authentication Configured, EMR Cluster Instances do not Allow Public Access, Elasticsearch Node-to-Node Encryption is Enabled, Elasticsearch Storage Encryption is Enabled, Amazon Elasticsearch Domain is in a VPC, No Access Keys for Root Account, MFA for Root Account is Enabled, Hardware MFA for Root Account is Enabled, MFA for Users with Console Access, No IAM Principals with access to blocked actions on KMS, No Empty IAM Groups, No Inline IAM Policies Attached, IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater), No IAM Principals with Full Administrator Permissions ":", IAM Access Keys Are Rotated every 90 Days, IAM Users in Groups, IAM Policies Attached to Roles or Groups Only, No Unused IAM User Credentials (90 Days), Lambda functions should be in a VPC., No Public Accessible Lambda Functions, RDS Cluster/Instance Security Group Does Not Allow 0.0.0.0/0 and ::/0, RDS Storage Encryption is Enabled, No Public Redshift Clusters, Redshift Clusters Encrypted At-Rest, Redshift Clusters Use Enhanced VPC Routing, No Public S3 Buckets, S3 Block Public Access is Enabled (Account-Level), No Direct Internet Access for SageMaker Notebook Instance, Secrets Manager Secrets Automatic Rotation is Enabled, Secrets Manager Secrets Are Rotated Per Schedule, Default Security Group No Rules, No Public SSM documents (customer owned), VPC Route Tables Restrict Public Access to IGW, Vpc security group restrict ingress common ports all, VPC Security Groups Should Restrict Ingress TCP And UDP Access From 0.0.0.0/0
11.10(h) Use of device (e.g., terminal) checks to determine, as appropriate, the validity of the source of data input or operational instruction: EC2 Instances Managed by Systems Manager (SSM), EC2 Instances Compliant with SSM Patching Requirements, EC2 Instance Compliant SSM Association Status
11.10(k) Use of appropriate controls over systems documentation that includes adequate controls over the distribution of, access to, and use of documentation for system operation and maintenance: Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure CloudTrail is Enabled for this Region, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, Database Migration Service Instance Not Public, EBS Snapshots Should Not Be Publicly Restorable, EC2 Instances in a VPC (No Classic EC2), EC2 Launch Templates Do Not Assign Public IPs, EMR Cluster Instances do not Allow Public Access, RDS Cluster/Instance Security Group Does Not Allow 0.0.0.0/0 and ::/0, RDS Storage Encryption is Enabled, RDS Logging Enabled, No Public Redshift Clusters, No Public S3 Buckets, S3 Block Public Access is Enabled (Account-Level), S3 Bucket Access Logging Enabled, No Direct Internet Access for SageMaker Notebook Instance, Default Security Group No Rules, No Public SSM documents (customer owned), Vpc security group restrict ingress common ports all, VPC Security Groups Should Restrict Ingress TCP And UDP Access From 0.0.0.0/0
11.200(a) Biometric electronic signature components and controls: No Access Keys for Root Account, MFA for Root Account is Enabled, Hardware MFA for Root Account is Enabled, MFA for Users with Console Access, IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater), IAM Access Keys Are Rotated every 90 Days
11.30 Controls for open systems: API Gateway domain names should use TLS 1.2 security policies, Application Load Balancer HTTP to HTTPS Redirect Enabled, Backup Recovery Points are Encrypted, CloudFront Distribution Does Not Allow HTTP Connections, CloudFront Security Policy Check, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, CloudWatch Log Group Encryption Enabled, AWS CodeBuild Project Artifact Encryption Check, CodeBuild S3 Logs Encryption is Enabled, DynamoDB Encryption with KMS Enabled, EC2 Default Encryption is Enabled, EC2 Instance Volumes are Encrypted, EFS Encryption At-Rest Enabled, Load Balancers Use SSL Certificates, Elastic Load Balancers Secure Listeners Only, Ensure Load Balancers Use ACM Certificates, Elasticsearch Node-to-Node Encryption is Enabled, Elasticsearch Storage Encryption is Enabled, Elasticsearch Enforces HTTPS for Client Access, Kinesis Data Stream Server Side Encryption Enabled, KMS Keys Not Pending Deletion, Ensure that KMS Key Rotation is Enabled, RDS Snapshots are Encrypted At-Rest, Redshift Clusters Encrypted At-Rest, Redshift Clusters Audit Logging Enabled, Redshift Cluster Encryption In-Transit is Enabled, S3 Bucket Encryption is Enabled, S3 Bucket Encryption in Transit is Enforced, S3 Default Encryption with KMS Key Check, SageMaker Endpoint Configuration Encrypted At-Rest, SageMaker Notebook Instance Encryption At-Rest Enabled, Secrets Manager Secrets Use Custom KMS Key, SNS Topic Encryption Enabled, API Gateway Stage Cache Encryption At-Rest is Enabled
11.300(b) Ensuring that identification code and password issuances are periodically checked, recalled, or revised (e.g., to cover such events as password aging): EMR Kerberos Authentication Configured, IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater), IAM Access Keys Are Rotated every 90 Days, No Unused IAM User Credentials (90 Days), Secrets Manager Secrets Automatic Rotation is Enabled, Secrets Manager Secrets Are Rotated Per Schedule
11.300(d) Use of transaction safeguards to prevent unauthorized use of passwords and/or identification codes, and to detect and report in an immediate and urgent manner any attempts at their unauthorized use to the system security unit, and, as appropriate, to organizational management: Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure CloudTrail is Enabled for this Region, Amazon GuardDuty is Enabled, AWS Security Hub is Enabled

The report includes actionable findings and remediation guidance for supported checks.